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This paper introduces quantum "multiple-Merlin"-Arthur proof systems in which Arthur receives multiple 
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equivalent to classical single-proof systems (i.e., usual Merlin-Arthur proof systems), it is unclear whether or 
not quantum multi-proof systems collapse to quantum single-proof systems (i.e., usual quantum Merlin-Arthur 
proof systems). This paper presents a necessary and sufficient condition under which the number of quantum 
proofs is reducible to two. It is also proved that, in the case of perfect soundness, using multiple quantum proofs 
does not increase the power of quantum Merlin- Arthur proof systems. 
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1 Introduction 



1.1 Background 

Merlin- Arthur proof systems, or Merlin- Arthur games as originally called, were introduced by Babai [9]. In a 
Merlin-Arthur proof system, powerful Merlin, a prover, presents a proof and Arthur, a verifier, probabilistically 
verifies its correctness with high success probability. The class of problems having Merlin-Arthur proof systems is 
denoted by MA, and has played important roles in computational complexity theory [9, 13, 11, 12, 10, 47, 44, 8, 
23, 19, 18,25,45]. 

A quantum analogue of MA was first discussed by Knill [33] and has been studied intensively [30, 48, 29, 26, 
49, 7, 39, 28, 1, 36, 38, 3, 5, 37]. In the most commonly-used version of quantum Merlin-Arthur proof systems, 
a proof presented by Merlin is a pure quantum state called a quantum proof and Arthur's verification process is a 
polynomial-time quantum computation. However, all the previous studies only consider the model in which Arthur 
receives a single quantum proof, and no discussions are done so far on the model in which Arthur receives multiple 
quantum proofs unentangled with each other. 

Classically, multiple proofs can be concatenated into a long single proof, and thus, there is no advantage to 
use multiple proofs. Quantumly, however, using multiple quantum proofs may not be computationally equivalent 
to using a single quantum proof, because knowing that a given proof is a tensor product of some quantum states 
might be advantageous to Arthur. For example, in the case of two quantum proofs versus one, consider the fol- 
lowing most straightforward Arthur's simulation of two quantum proofs by a single quantum proof: given a single 
quantum proof that is expected to be a tensor product of two pure quantum states, Arthur first runs some prepro- 
cessing to rule out any quantum proof far from states of a tensor product of two pure quantum states, and then 
performs the verification procedure of the original two-proof system. It turns out that this most straightforward 
method does not work well, since there is no physical method that determines whether a given unknown state is in 
a tensor product form or even maximally entangled, as will be shown in Section 6. Another fact is that the unpub- 
lished proof by Kitaev and Watrous for the upper bound PP of the class QMA of problems having single-proof 
quantum Merlin-Arthur proof systems no longer works well for the multi-proof cases with the most straightfor- 
ward modification. The simplified proof by Marriott and Watrous [39] for the same statement and even the proof 
of QMA C P SPACE [30, 31] are also the cases. Furthermore, the existing proofs for the property that parallel 
repetition of a single-proof system reduces the error probability to be arbitrarily small [32, 48, 31, 39] cannot be 
applied to the multi-proof cases. Of course, these arguments do not imply that using multiple quantum proofs is 
more powerful than using only a single quantum proof from the complexity theoretical viewpoint. The authors 
believe, however, that these at least justify that it is meaningful to consider the multi -proof model of quantum 
Merlin-Arthur proof systems. It is interesting to note that here the nonexistence of entanglement among proofs 
may have the possibility of enhancing the verification power, unlike the usual situations of quantum information 
processing where we make use of the existence of entanglement. Moreover, the multi-proof model has importance 
even in quantum information theory, because the model is inherently related to entanglement theory. Indeed, after 
the completion of this work, Aaronson, Beigi, Drucker, Fefferman, and Shor [2] succeeded in proving a strong 
connection between our model and the famous ' Additivity Conjecture" in entanglement theory, which is one of the 
most important conjectures in quantum information theory. 

1.2 Contribution of This Paper 

Motivated by the observations listed in the previous subsection, this paper extends the usual single-proof model 
of quantum Merlin-Arthur proof systems to the multi-proof model by allowing Arthur to use multiple quantum 
proofs, which are given in a tensor product form of multiple quantum states. One may think of this model as a 
special case of quantum multi-prover interactive proof systems [34] in which a verifier cannot ask questions to 
provers, and provers do not share entanglement a priori. Formally, we say that a problem A = {A ycs , A no } has a 
(k, c, s)-quantum Merlin-Arthur proof system if there exists a polynomial-time quantum verifier V such that, for 
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every input x, (i) if x € A ycs , there exists a set of k(\x\) quantum proofs that makes V accept x with probability 
at least c(|x|), and (ii) if x 6 A no , for any set of k(\x\) quantum proofs given, V accepts x with probability at 
most s(|x|). The resulting complexity class is denoted by QMA(fc,c,s). We often abbreviate QMA(fc, |, |) as 
QMA(fc) throughout this paper. 1 

Besides our central question whether or not quantum multi-proof Merlin- Arthur proof systems collapse to quan- 
tum single-proof systems, it is also unclear if there are k\ and k% with k\ / ki such that QMA(fci) = QMA(fc2)- 
Towards settling these questions, this paper presents a necessary and sufficient condition under which the number of 
quantum proofs is reducible to two. Our condition is related to the possibility of amplifying success probability of 
quantum two-proof Merlin- Arthur proof systems without increasing the number of quantum proofs. More formally, 
it is proved that QMA(fc, c, s) = QMA(2, |, |) for any polynomially-bounded function k > 2 and any two-sided 
bounded error probability (c, s) if and only if QMA(2,c, s) = QMA(2, |, |) for any two-sided bounded error 
probability (c, s). 2 Alternatively, it is proved that quantum multi-proof Merlin-Arthur proof systems are equiva- 
lent to usual single-proof ones if and only if quantum two-proof Merlin-Arthur proof systems are equivalent to 
usual single-proof ones. That is, QMA(/c, c, s) = QMA for any polynomially-bounded function k > 2 and any 
two-sided bounded error probability (c, s) if and only if QMA(2, c, s) = QMA for any two-sided bounded er- 
ror probability (c, s). The key ingredient to show these properties is the claim that, for any quantum multi -proof 
Merlin-Arthur proof system with some appropriate condition on completeness and soundness, we can reduce the 
number of proofs by (almost) two-thirds (where the gap between completeness and soundness becomes worse, but 
is still bounded by an inverse-polynomial). This is done by using the controlled-swap test, which often plays a key 
role in quantum computation (e.g., in Refs. [32, 17]). 

It is also proved for the case of perfect soundness that, for any polynomially-bounded function k > 2 and 
any completeness c, QMA(fc, c, 0) = QMA(l,c, 0). With further analyses, the class NQP, which derives from 
another concept of "quantum nondeterminism" introduced by Adleman, DeMarrais, and Huang [4] and discussed 
by a number of studies [22, 21, 51, 50], is characterized by the union of QMA(l,c, 0) for all error probability 
functions c. This bridges between two existing concepts of "quantum nondeterminism". 

1.3 Recent Progresses 

After the completion of this work, a number of studies showed very intriguing properties on our model. 

Liu, Christandl, and Verstraete [38] showed that the Pure State A-Representability problem, which 
naturally arises in quantum chemistry, can be verified by a quantum two-proof Merlin-Arthur proof system with 
two-sided bounded error. Interestingly, the problem is not known to be in usual QMA. 

Blier and Tapp [16] proved that the NP-complete problem Graph 3-COLORING has a quantum two-proof 
Merlin- Arthur proof system with one-sided bounded error of perfect completeness, where both of the two unentan- 
gled quantum proofs consist of only logarithmically many qubits. The soundness is bounded away from one only 
by an inverse-polynomial in their proof system. 

Aaronson, Beigi, Drucker, Fefferman, and Shor [2] proved that the NP-complete problem 3-S AT has a quantum 
multi-proof Merlin- Arthur proof system of perfect completeness with constant soundness error, where the number 
of proofs is almost square root of the instance size, and each quantum proof consists of only logarithmically many 
qubits. They further showed that the "Additivity Conjecture" would imply that any quantum two-proof Merlin- 

'Here we choose completeness and soundness accepting probabilities | and | to define the class QMA(fc), but there may be other 
reasonable choices. For instance, QMA(fc) could be defined as the union of QMA(fc, 1 — e, e) for all negligible functions e. It is possible 
that other reasonable definitions of QMA(fc) form different classes from the one defined in this paper, since it is not known how to amplify 
the success probability of QMA(fc). The authors believe, however, that the choice of § and | would best highlight the essence of the results 
in this paper. 

2 This improves the result proved in our preliminary conference version [35], where we required the amplifiablity of the success prob- 
ability not only for two-proof systems but also for fc-proof systems, for every k. Also, the statement was originally proved only for every 
constant k, whereas the improved statement in the current version holds even for every polynomially-bounded function k. The same 
improvements were done independently by Aaronson, Beigi, Drucker, Fefferman, and Shor [2]. 
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Arthur proof system can be made to have arbitrarily small two-sided bounded error, and thus, QMA(fc) = QMA(2) 
for any polynomially bounded function k > 2. 

1.4 Organization of This Paper 

The remainder of this paper is organized as follows. In Section 2 we give a brief review for several basic no- 
tions of quantum computation and information theory used in this paper. In Section 3 we formally define the 
multi-proof model of quantum Merlin-Arthur proof systems. In Section 4 we show a condition under which 
QMA(fc) = QMA(2). In Section 5 we focus on the systems of perfect soundness. In Section 6 we show that 
there is no physical method that determines whether a given unknown state is in a tensor product form or maxi- 
mally entangled. Finally, we conclude with Section 7 which summarizes this paper. The conference version of this 
paper [35] also included the result that there exists an oracle relative to which QMA(fc) does not contain co-UP. 
The present version omits this result, since it turned out that the statement is easily proved by using the result by 
Raz and Shpilka [43]. 

2 Preliminaries 

We start with reviewing several fundamental notions used in this paper. Throughout this paper we assume that all 
input strings are over the alphabet £ = {0, 1}, and N and Z + denote the sets of positive and nonnegative integers, 
respectively. For any Hilbert space TL, let In denote the identity operator over TL. In this paper, all Hilbert spaces 
are of dimension power of two. 

2.1 Quantum Fundamentals 

First we briefly review basic notations and definitions in quantum computation and quantum information theory. 
Detailed descriptions are found in Refs. [41, 31], for instance. 

A pure quantum state, or a pure state in short, is a unit vector \if)) in some Hilbert space TL. For any Hilbert 
space TL, let |0^) denote the pure quantum state in TL of which all the qubits are in state |0). A mixed quantum state, 
or a mixed state in short, is a classical probability distribution (pi, \tpi)), < pi < 1, YltiPi = 1 over P ure states 
\ipi) G TL. This can be interpreted as being in the pure state \tpi) with probability pi. A mixed state (pi, {ipi}) is 
often described in the form of a density operator p = YliPil^i^il- Any density operator is positive semidefinite 
and has trace one. It should be noted that different probabilistic mixtures of pure states can yield mixed states with 
the identical density operator. It is also noted that there is no physical method (i.e., no measurement) to distinguish 
mixed states with the identical density operator. Therefore, density operators give complete descriptions of quantum 
states, and we may use the term "density operator" to indicate the corresponding mixed state. For any Hilbert space 
TL, let D(TL) denote the set of density operators over TL. 

One of the important operations to density operators is the trace-out operation. Given Hilbert spaces TL and K 
and a quantum state with its density operator p in Y)(TL ® K,), the quantum state after tracing out K, has its density 
operator in T)(TL) defined by tr^p = Yli=i(^'H ® ( e i\)p(In ® |ej)) for any orthonormal basis {|ej)} of K, where 
d is the dimension of /C. To perform this operation on some part of a quantum system gives a partial view of the 
quantum system with respect to the remaining part. 

A positive operator-valued measure (POVM) on a Hilbert space TL is defined to be a set M = {Mi, . . . , M&} 
of nonnegative Hermitian operators over TL such that Yli=i Mi = In- F° r an Y POVM M on TL, there is a quantum 
mechanical measurement that results in i with probability exactly tr(Mip) for any p in D(TL). See Refs. [24, 42] 
for more rigorous descriptions on quantum measurements. 

The fidelity F(p, a) between two density operators p and a in ~D(TL) is defined by F(p, a) = tx^J~^fpa\fp. 
This paper uses the following two properties on fidelity. 
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Lemma 1 ([27]). For any Hilbert spaces Ti and K. and any density operators pi, o\ G D(7i) and P2,&2 £ D(/C), 

F{pi <8> p2, o-i ® cr 2 ) = F(p 1 ,a 1 )F(p 2 , a 2 ). 

Lemma 2 ([46, 40]). For any Hilbert space 7i and any density operators p,a,£, G ~D(TL), 

F(p,a) 2 + F(a,0 2 <l + F(p,0. 



2.2 Quantum Circuits 

Next we review the model of quantum circuits. We use the following notion of polynomial-time uniformly gener- 
ated families of quantum circuits. 

A quantum circuit consists of a finite number of quantum gates that are applied in sequence to a finite number 
of qubits. A family {Q x } of quantum circuits is polynomial-time uniformly generated if there exists a deterministic 
procedure that, on every input x, outputs a description of Q x and runs in time polynomial in It is assumed 
that the circuits in such a family are composed of gates in some reasonable, universal, finite set of quantum gates. 
Furthermore, it is assumed that the number of gates in any circuit is not more than the length of the description of 
that circuit. Therefore Q x must have size polynomial in \x\. For convenience, we may identify a circuit Q x with 
the unitary operator it induces. 

Since non-unitary and unitary quantum circuits are equivalent in computational power [6], it is sufficient to 
treat only unitary quantum circuits, which justifies the above definition. For avoiding unnecessary complication, 
however, the descriptions of procedures may include non-unitary operations in the subsequent sections. Even in 
such cases, it is always possible to construct unitary quantum circuits that essentially achieve the same procedures 
described. 

3 Definitions 

Here we formally define quantum multi-proof Merlin-Arthur proof systems. Although all the statements in this 
paper can be proved only in terms of languages without using promise problems [20], in what follows we define 
models and prove statements in terms of promise problems, for generality and for the compatibility with some 
subsequent studies on our model [38, 37]. 

A quantum proof of size q is a pure quantum state of q qubits. 

A quantum verifier V for quantum k-proof Merlin-Arthur proof systems is a polynomial-time computable 
mapping of the form V : S* — > £*. For every input x € £*, the string V(x) is interpreted as a description of a 
polynomial-size quantum circuit. In other words, {^(x)} forms a polynomial-time uniformly generated family of 
quantum circuits. The qubits upon which each V(x) acts are divided into k + 1 sets: one set, consisting of qv(|a;|) 
qubits, serves as work space of V, and each of the rest k sets serves as "witness space" of V that is used for storing 
a quantum proof of size c/.m (|x|), for some polynomially bounded functions qy, <Lm : ^ + —> N. One of the qubits 
in the work space of V is designated as the output qubit. 

A set of k quantum proofs is compatible with a quantum verifier V if the size of every quantum proof coincides 
with the size of witness space of V. 

Suppose that V receives k quantum proofs \(j>i), . . . , \<j>k)- The probability that V accepts x is defined to be the 
probability that an observation of the output qubit in the {|0), |1)} basis yields |1), after the circuit V(x) is applied 
to the state |0y) \4>i) <8> • • • \<fik)> where V is the Hilbert space corresponding to the work space of V. 

More generally, the number of quantum proofs may not necessarily be a constant, and may be a polynomially 
bounded function k : Z + —> N of the input length. 
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Definition 3. Given a polynomially bounded function k: Z + — > N and functions c, s: Z + — > [0,1], a problem 
A = {A yes , A no } is in QMA(/c, c, s) if there exists a quantum verifier V for /c -proof quantum Merlin-Arthur proof 
systems such that, for every x, 

(Completeness) if x € A ycs , there exists a set of quantum proofs \<j>i), . . . , \(/>k(\x\)) compatible with V that makes 
V accept x with probability at least c(|x|), 

(Soundness) if x € A no , for any set of quantum proofs \4>i), ... , \4>k(\x\)} compatible with V, V accepts x with 
probability at most s(|x|). 

We say that a problem A = {A ycs , A no } has a (k, c, s)-quantum Merlin-Arthur proof system, or a QMA(fc, c, s) 
proof system in short, if and only if A is in QMA(fc, c, s). For simplicity, we abbreviate QMA(fc, |, |) as QMA(fc) 
for every k. 

Note that allowing quantum proofs of mixed states does not increase the maximal accepting probability of proof 
systems, which justifies the model defined above. For readability, in what follows, the arguments x and |x| may be 
dropped in various functions, if it is not confusing. 

4 Condition under which QMA(fc) = QMA(2) 

Classically, it is trivial to show that classical multi-proof Merlin-Arthur proof systems are essentially equivalent 
to single-proof ones. However, it is unclear whether quantum multi-proof Merlin-Arthur proof systems col- 
lapse to quantum single-proof systems. Moreover, it is also unclear whether there are k\ and of k\ / ki 
such that QMA(fci) = QMA(&2). Towards settling these questions, here we give a condition under which 
QMA(fc) = QMA(2) for every polynomially-bounded function k > 2. 

Formally, we consider the following condition on the possibility of amplifying the success probability of quan- 
tum two-proof Merlin- Arthur proof systems without increasing the number of quantum proofs: 

(*) For any two-sided bounded error probability (c, s), QMA(2, c, s) coincides with QMA(2, §, |). 

Our main result is the following theorem, which will be shown in this section. 

Theorem 4. QMA(fc,c,s) = QMA(2, |, \)for any polynomially-bounded function k: Z + — > N satisfying k>2 
and any two-sided bounded error probability (c, s) if and only if the condition (*) is satisfied. 

4.1 Achieving Exponentially Small Completeness Error 

We first show a simple way of achieving exponentially small completeness error while keeping soundness error 
bounded away from one, which works well for any proof systems. The same result was independently proved by 
Aaronson, Beigi, Drucker, Fefferman, and Shor [2, Lemma 6]. 

Lemma 5. Let c, s : Z + — > [0, 1] be any functions that satisfy c — s > ^for some polynomially bounded function 
q : Z + — > N, and let H be any proof system with completeness at least c and soundness at most s. Consider another 
proof system IT' such that, for every input of length n, IT carries out N = 2p(n) (q(n)) 2 attempts of TI in parallel for 
a polynomially bounded function p : Z + — ► N, and accepts iff at least c ( n )+ s ( n ) -fraction of these N attempts results 
in acceptance in IT. Then W has completeness at least 1 — 2~ p and soundness at most < 1 — < 1 — ^. 

Proof. Let Aj be the random variable that takes 1 iff the ith attempt of II in II' results in acceptance and otherwise 

takes 0, for each 1 < i < N, and let Y be the random variable defined by Y = — -. 

Noticing that the accepting probability in IT is given by Pr[Y > gM+fW ] and that E [Y] = ^ =1 j^ [Xl] , the 
completeness bound of II' directly follows from the Hoeffding bound while the soundness bound of IT directly 
follows from Markov's inequality. □ 
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Controlled-Swap Test 



1. Apply the Hadamard transformation H to B. 

2. Apply the controlled-swap operator to Ri and R2 using B as a control qubit. That is, swap the contents of Ri 
and R2 if B contains 1, and do nothing if B contains 0. 

3. Apply the Hadamard transformation H to B. Accept if B contains 0, and reject otherwise. 



The following is an immediate corollary of Lemma 5. 
Corollary 6. For any polynomially bounded functions k, p : Z + — > N and any two-sided bounded error probability 



4.2 Controlled-Swap Test with Mixed States 

Next we show a fundamental property of the controlled-swap test when applied to a pair of mixed states. This 
property is easy to prove. To the best knowledge of the authors, however, it has not appeared previously, and the 
authors believe that this property will be useful in many cases. 

The controlled-swap operator exchanges the contents of two registers Ri and R2 if the control register B con- 
tains 1, and does nothing if B contains 0. 

Given a pair of mixed states p and a of n qubits of the form p (g> a, prepare quantum registers B, Ri, and R2. 
The register B consists of only one qubit that is initially set to state 1 0) , while the registers Ri and R2 consist of n 
qubits and p and a are initially set in Ri and R2, respectively. 

The controlled-swap test is performed by running the algorithm described in Figure 1 . 

Proposition 7. The probability that the input pair of mixed states p and a is accepted in the controlled-swap test 
is exactly \ + ^tr(pcr). 

Proof. Let 1Z\ and H2 denote the Hilbert spaces corresponding to Ri and R2, respectively. 

Let p = Yl,iPi\ e i) ( e i\ an d G = Yli Qi\fi)(fi\ b e tne decompositions of p and a with respect to some orthonor- 
mal bases {|ej)} and of 1Z\ and H2, respectively. Then the state in (Ri, R2) is |e«) (g) \fj) with probability 

1 \(e-\f-)\ 2 

Piqj, and in such a case, the test results in acceptance with probability i + ,x . 
Therefore, the states p and a are accepted with probability 



Figure 1 : The controlled-swap test. 
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as desired. □ 
4.3 Reducing the Number of Proofs 

Using Proposition 7, we can show the following lemma, which is the key to proving Theorem 4. 

Lemma 8. For any polynomially bounded function k:Z + ^N, any r£ {0,1,2}, and any functions 
e, 5: Z + — > [0, 1] satisfying 5 > lOe, 

QMA(3A: + r, 1 - e, 1 - 8) C QMA^fc + r, 1 - |, 1 - — ) . 

The essence of the proof of Lemma 8 is the basis case where k = 1 and r = 0. We first give a proof for this 
particular case, which will be helpful to see the idea. 

Proposition 9. For any functions e, 5: Z + — ► [0, 1] satisfying 5 > 10e, 

QMA(3,1-£,1-(5)CQMA(2,1-|,1--). 

Proof. Let yl = {A yes , A DO } be a problem in QMA(3, 1 — e, 1 — S). Given a QMA(3, 1 — e, 1 — 6) proof system 
for A, we construct a QMA(2, 1 — |, 1 — ^) proof system for A in the following way. 

Let V be the quantum verifier of the original QMA(3, 1 — e, 1 — S) proof system. For every input x, suppose 
that V uses gv(M) private qubits, and each of the quantum proofs V receives consists of g.A/((M) qubits, for some 
polynomially bounded functions qy, '■ ^ + — ► N. Let V(x) be the unitary transformation V applies. 

Our new quantum verifier W in the QMA(2, 1 — | , 1 — Jj) proof system prepares quantum registers Ri, R2, 
Si, and S2 for quantum proofs and quantum registers V and B for his private computation. Each Rj and S« consists 
of (/.m(M) qubits, V consists of gy(|a;|) qubits, and B consists of a single qubit. All the qubits in (V, B) are 
initialized to state |0). W receives two quantum proofs \ipi) and \1jj2) of 2g_A/((M) qubits in (Ri, Si) and (R2, S2), 
respectively, which are expected to be of the form 

\i>i) = \<f>i)®\fo), \ih) = \<h)®\<h), 

where each \<fii) is the ith quantum proof the original quantum verifier V would receive. Of course, each may 
not be of the form above and the first and the second ^(kl) qubits of may be entangled. Let V, B, each IZi, 
and each Si be the Hilbert spaces corresponding to the quantum registers V, B, Rj, and Sj, respectively. 
The protocol of W is described in Figure 2. 

For the completeness, suppose that the input x is in A ycs . In the original proof system, there exist quan- 
tum proofs \4>i), 1^2), and 1^3) that cause the original quantum verifier V to accept x with probability at least 
1 — e(|x|). In the constructed protocol, let the quantum proofs |V>i) and ^2) be of the form = (g> 1^3} 
and ^2) = |^2) <8) |03)- Then it is obvious that the constructed quantum verifier W accepts x with certainty in the 
Separability test and with probability at least 1 - e(|x|) in the Consistency test, and thus, the complete- 
ness follows. 

Now for the soundness, assume that the input x is in A no . 

Consider any pair of quantum proofs |V4) and \ip' 2 ) of 2q_a^(|x|) qubits, which are set in the pairs of the quantum 
registers (Ri, Si) and (R2, S2), respectively. Let p = tr^ |^' 1 )(V' / il and a = tr^l^)^!- 
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Verifier's Protocol in Two-Proof System 

1. Receive the first quantum proof |V>i) in (Ri, Si) and the second quantum proof \ip2) in (R2, S2). 

2. Do one of the following two tests uniformly at random. 

2.1 (Separability test) 

Perform the controlled-swap test over Si and S2 using B as a control qubit. That is, perform the 
following: 

2.1.1 Apply the Hadamard transformation H to B. 

2.1.2 Apply the controlled-swap operator to Si and S2 using B as a control qubit. 

2.1.3 Apply the Hadamard transformation H to B. Accept if B contains 0, and reject otherwise. 

2.2 (Consistency test) 

Apply V(x) to the qubits in (V, Ri, R2, Si). Accept iff the result corresponds to the accepting compu- 
tation of the original quantum verifier. 



Figure 2: Verifier's protocol in two-proof system. 

(i) In the case tr (pa) < 1 — |: 

In this case, by Proposition 7, the probability p sep that the input x is accepted in the SEPARABILITY TEST is 
at most 

1 1/ <5\ S 

Thus the verifier W accepts the input x with probability at most \ + ^ < 1 — ^. 

(ii) In the case tr(pcr) > 1 — |: 

Let V = V(x) (g) Is 2 and IT acc = IT acc (g> I$ 2 , where n acc is the projection onto accepting states of the 
original proof system. For notational convenience, here it is assumed that V and IT acc are applied to 
(V, Ri, Si, R2, S2) in this order of registers, although the registers to which V(x) and Il acc are applied are 
assumed to be in order of V, Ri, R 2 , and Si. Let \a) = ||n acc v(| 0v )^>) 8) |^))|| ^c^'(l v) l^i> l^2» 
and = |0y) <8> |V4) ® Then the probability p cons that the input x is accepted in the CONSISTENCY 
TEST is at most 

Peons <F(V^a)(a\V, \0) ((3\) 2 . 

The fact tr (per) > 1 — | implies that the maximum eigenvalue A of p satisfies A > 1 — |. Thus there exists 
a pure state \4>[) G 1Z\ (8> S\ of the form \4>[} = ® \r)[) for some pure states G TZ\ and Ir/i) G S\ 
such that 

f{\&m\mm\) > fi^l, 

since p = tr-^ |Y4) (V4 I- Similarly, the maximum eigenvalue of a is more than 1 — | and there exists a pure 
state \4>' 2 ) G 7^2 ® ^2 of the form \<p' 2 ) = |£ 2 ) <8> \rf 2 ) for some pure states |£ 2 ) G ^-2 and |r/ 2 ) G S2 such that 

Therefore, letting I7) = |0y) (g> 1^) ® |</>' 2 ), we have from Lemma 1 that 

F(|/m|7><7l)>l-|. 
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Furthermore, from the soundness condition of the original proof system, it is easy to see that 



F(V^\a)(a\V, | 7 )( 7 |) = F(\a)(a\, V^)^) < VT^6. 
Using Lemma 2, we have that 

F(V^\a)(a\V,\(3)((3\) 2 + F(\(3)((3\,\ 7 )( 7 \) 2 < 1 + F(V*\a)(a\V, | 7 ><7l) ■ 

It follows that 

Peons < 1 + F(V*\a)(a\V, | 7 ><7l) " F(|/3></3|, l7><7l) 2 

, / 5\2 5 25 5 2 5 

< l + Vl-5- (1--) <2 1 + <1 . 

V 5/ - 2 5 25 ~ 10 

Thus the verifier accepts the input x with probability at most | + < 1 — 

Hence the soundness is at most 1 — ^, as required. □ 
Now we prove Lemma 8. 

Proof of Lemma 8. The proof is a simple generalization of the case of Proposition 9. 

Let A = {A ycs , ^ no } be a problem in QMA(3/c + r, 1 - e, 1 - 8). Given a QMA(3fc + r, 1 - e, 1 - 8) proof 
system for A, we construct a QMA(2fc + r, 1 — |, 1 — Jj) proof system for A in the following way. 

Let F be the quantum verifier of the original QMA(3fc + r, 1 — e, 1 — <5) proof system. For every input x, 
suppose that V uses <zv(M) private qubits, and each of quantum proofs V receives consists of <7.m(M) qubits, for 
some polynomially bounded functions qv,QM '■ ^ + ~^ N. Let V(x) be the unitary transformation V applies. 

Our new quantum verifier W in the QMA(2/c + r, 1 — §, 1 — jfj) proof system prepares quantum registers 
Ri,i,.. • , Ri,fc, R2,i, • • • , R2,fc, Si,i, . . . ,Si jfe , S 2 ,i,.. • ,S 2 ,fe, R3,i, • • • , R3,r, S 3) i,.. . ,S 3)J . for quantum proofs and 
quantum registers V and B for his private computation. Each of Rjj and Sjj consists of <z.m(|x|) qubits, V consists 
of gv(|x|) qubits, and B consists of a single qubit. All the qubits in (V, B) are initialized to state |0). Let V, B, each 
IZij, and each Sij be the Hilbert spaces corresponding to the quantum registers V, B, Rjj, and Sjj, respectively. 
W receives 2k + r quantum proofs |^i,i), ... , \ipi,k), \^2,i), • • • , |V>2,fc), and |-03,i>, • • • , |V>3,r) of 2q M (\x\) qubits 
in (Ri,i,Si ; i), . . . , (Ri,fc,Si )fc ), (R 2 ,i,S 2j i),. . • > ( R 2,fc, S 2 ,fe), and (R 3 ,i,S 3) i), . . . , (R 3 , r , S 3 , r ), respectively, which 
are expected to be of the form 

IV>iji> = I 0ji > ® l^fe+ji), 

|V"2ji> = l^fc+ji) ® |02fc+ji>, 
IV'Sja) = l<fefc+j 2 > ® |05 3 j 2 ), 

for each 1 < ji < k and 1 < j 2 < r, where each \<pi) is the zfh quantum proof the original quantum verifier V 
would receive. 

The protocol of W is described in Figure 3. 

The rest of the proof is essentially the same as in the case of Proposition 9. When ana- 
lyzing soundness, consider any set of 2k + r quantum proofs |V4i)> • • • > Wi fc)> W2 i)> • • • > W2 fc)> an( ^ 
|^3 1), • • • , 1^3 r ) °f ^Qm(\ x \) qubits, which are set in the quantum registers (Ri,i, S^i), . . . , (Ri,fc, Si^), 
(R2,i,S 2 ,i), . . . , (R 2 ,fc,S 2jfe ), and (R 3 ,i,S 3 ,i), . . . , (R 3 ,r,S 3 ,r), respectively, and let = ® ■ ■ ■ <8> \ij/ ljk ) 
and \ip' 2 ) = l^i) ® ■ ■ ■ <8> |V4,fc)- Let p = pi <g> ■ ■ ■ <g> p fc and a = u\ ® ■ ■ ■ ® a k , where pj = ^n ltj W\j){^j\ 
and Gj = toiZzj W2 j){^2 j\ f° r eacn 1 < j < A;. Note that, if tr(pcr) > 1 — |, there exist pure 
states € T^i,j, |£ 2 j) e ^-2,j, Wi,j) e <5i,j> and \i] 2 j} € <S 2 ,j for each 1 < j < k such that the 
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Verifier's Protocol in (2k + r)-Proof System 

1. For each G {(1, 1), . . . , (1, k), (2, 1), . . . , (2, k), (3, 1), . . . , (3, r)}, receive the quantum proof in 
(Rij, Sij). Reject if any of the qubits in S^j contains 1, for 1 < j < r. 

2. Do one of the following two tests uniformly at random. 

2.1 (Separability test) 

Perform the controlled-swap test over (S^i, . . . , Si ^) and (S2,i, • • • , S2,fc) using B as a control qubit. 
That is, perform the following: 

2.1.1 Apply the Hadamard transformation H to B. 

2.1.2 Apply the controlled-swap operator to (S^i, . . . , Si^) and (S2,i, . . . , S2,fc) using B as a control 
qubit. 

2.1.3 Apply the Hadamard transformation H to B. Accept if B contains 0, and reject otherwise. 

2.2 (Consistency test) 

Apply V(x) to the qubits in (V, R^i, . . . , R ljfc , R 2 ,i, . . . , R 2 ,fe, S^i, . . . , Si )fc , R 3 ,i, • • • , Rz,r)- Accept 
iff the result corresponds to the accepting computation of the original quantum verifier. 



Figure 3: Verifier's protocol in (2k + r)-proof system, 
states |#) = ® ® • • • ® Wi, k ) ® Wi, k ) and \<f/ 2 ) = \? 21 ) ® • • • ® \^ k ) ® W 2 , k ) satisfy that 

Fd^iX^ii, |V»i)<V4l) > v /l_ I and F (l^2)(^2l' IV4X^2l) > v /l_ s- Now the claim follows from the ^g"- 

ment almost parallel to the proof of Proposition 9. □ 

Now Theorem 4 can be proved by using the transformation in Lemma 8 repeatedly. 

Proof of Theorem 4. The "only if" part is obvious and we show the "if" part. 

From Corollary 6, we have that QMA(fc, c, s) C QMA(/c, 1 — 2~ p , 1 — ^) for any polynomially bounded 
function p: Z+ — ► N. Now we repeatedly apply the transformation in Lemma 8 O(logfc) times, and finally we 
can show the inclusion QMA(/c, 1 - 2~ p , 1 - £=2) C QMA(2, 1 - 2 _p , 1 — -) for some polynomially bounded 
function q : Z + — > N. Note that the size of the circuit of the verifier after each application of the transformation 
in Lemma 8 is at most some constant times that of the original verifier plus an amount bounded by a polyno- 
mial in the input length. Thus, given a description of the circuit of the verifier in the original fc-proof system, 
one can compute in time polynomial in the input length a description of the circuit of the verifier in the re- 
sulting two-proof system. From our assumption, QMA(2, 1 — 2~ p , 1 — |) = QMA(2, |, |), and thus, the in- 
clusion QMA(k, c, s) C QMA(2, |, |) follows. The other inclusion is trivial since our assumption implies that 
QMA(2, |, |) = QMA(2, c, s), and we have the theorem. □ 

The following is an immediate corollary of Theorem 4. 

Corollary 10. QMA(fe,c, s) = QMA for any polynomially-bounded function k: Z + — > N satisfying k > 2 and 
any two-sided bounded error probability (c, s) if and only if QMA(2, c, s) = QMA for any two-sided bounded 
error probability (c, s). 

Proof. The proof is almost parallel to the proof of Theorem 4. Again the "only if" part is obvious and we show the 
"if" part. 
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Using the same argument as in the proof of Theorem 4, we can show the inclusion 



Remark. Theorem 4 improves the original statement in our conference version [35] in two ways. First, the condi- 
tion (*) now only requires the amplifiablity of the success probability for two-proof systems, whereas our original 
condition required it for every -proof system. Second, now QMA(fc) even with every polynomially-bounded func- 
tion k coincides with QMA(2) if the condition holds. Previously, we showed it only for QMA(fc) with every con- 
stant k. The same improvements were independently done by Aaronson, Beigi, Drucker, Fefferman, and Shor [2] 
but with a different proof. Instead of repeatedly applying the transformation that reduces the number of proofs 
by two-thirds as above, they showed a direct method of reducing the number of proofs to two [2, Theorem 23]. 
Although the resulting two-proof system from their transformation also has soundness only polynomially bounded 
away from one, their soundness is better than ours in most cases (except for the case where the gap between com- 
pleteness c and soundness s in the original system is so small relative to the number k of proofs that c — s € o(k~ a ), 
where a = i^ > ^° 1 — 1 ~ 6.388 • • •, in which case our analysis gives better soundness). 

5 Cases with Perfect Soundness 

This section focuses on the quantum multi-proof Merlin- Arthur proof systems of perfect soundness. In the case of 
perfect soundness, it is proved that multiple quantum proofs do not increase the verification power, which also gives 
a connection between two existing concepts of "quantum nondeterminism". Formally, the following is proved. 

Theorem 11. For any polynomially bounded function k: Z + — ► N and any function c: Z + — ► [0, 1], 



Proof. Let A = {^4 ycs , A no } be a problem in QMA(fc, c, 0). Given a QMA(fc, c, 0) proof system for A, we con- 
struct a QMA(1, c, 0) proof system for A in the following way. 

Let V be a quantum verifier of the QMA(fc, c, 0) proof system. For every input x, assume that each quantum 
proof V receives is of size g(|x|). 

Our new quantum verifier W in the QMA(1, c, 0) proof system receives one quantum proof of size /c(|rc|)g(|x|) 
and simulates V with this quantum proof. 

The completeness is clearly at least c. 

For the soundness, assume that the input x is in A no . Let \<f>) be any quantum proof of size Let 
ej be the lexicographically ith string in £ fe (l x IMI x l). Note that, for every i, the original verifier V never accepts x 
when the k(\x\) quantum proofs he receives form the state \ei). Since any \(j>) is expressed as a linear combination 
of these |e,), it follows that W rejects x with certainty. □ 

Let EQMA(fc) = QMA(fc,l,0) and RQMA(fc) = QMA(fc, ±, 0) for every k. Theorem 11 implies that 
EQMA(fc) = EQMA(l) and RQMA(/c) = RQMA(l). Furthermore, one can consider the complexity class 
NQMA(fc) that combines two existing concepts of "quantum nondeterminism", QMA(fe) and NQP. 

Definition 12. A problem A = {A yes , A no } is in NQMA(fc) if there exists a function c: Z + — ► (0, 1] such that A 

is in QMA(fc,c, 0). 

Note that NQMA(fc) = NQMA(l) is also immediate from Theorem 11. The next theorem shows that 
NQMA(l) coincides with the class NQP. 




QMAO, c, 0) = QMA(1, c, 0). 
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NQP Simulation of NQMA Proof System 

1. Apply the Hadamard transformation H to every qubit in Si. 

2. Copy the contents of Si to those of S2. 

3. Apply V(x) to the pair of quantum registers (R, Si). Accept if the contents of (R, Si) make the original 
verifier accept. 



Figure 4: NQP simulation of an NQMA proof system. 
Theorem 13. EQMA(l) C RQMA(l) C NQMA(l) = NQP. 

Proof. It is sufficient to show that NQMA(l) C NQP, since EQMA(l) C RQMA(l) C NQMA(l) and 
NQMA(l) D NQP hold obviously. 

Let A = {A yes ,A no } be a problem in NQMA(l). Given an NQMA(l) proof system for A, we construct an 
NQP algorithm for A. 

Let V be the quantum verifier of the NQMA(l) proof system. For every input x, suppose that V uses 
private qubits, and each quantum proof V receives consists of (?.m(M) qubits, for some polynomially bounded 
functions gy, qj^ : Z + — > N. Let V(x) be the unitary transformation V applies. 

In the NQP algorithm for A, we prepare quantum registers R, Si, and S2, where R consists of c/v(M) qubits 
and each Sj consists of </.m(M) qubits. All the qubits in R, Si, and S2 are initialized to state |0). The precise 
algorithm is described in Figure 4. 

For the completeness, suppose that the input x is in A yes . In the original NQMA(l) proof system for A, there 
exists a quantum proof \4>) of size gjwd^l) that causes V to accept x with non-zero probability. Suppose that V 
never accepts x with any given quantum proof |e») for 1 < i < 2 qM ^ x \\ where e$ is the lexicographically ith string 
in YPM(\n\) m Then with a similar argument to the proof of Theorem \\,V never accepts x with any given quantum 
proof \4>) of size <7.m(|x|), which contradicts the assumption. Thus there is at least one |ej) that causes V to accept 
x with non-zero probability. Hence, in the algorithm in Figure 4, the probability of acceptance must be non-zero, 
since it simulates with probability 2~ qM ^ x ^ the case where V is given a proof \ei) for every i. 

Now for the soundness, suppose that the input x is in A no . In the original NQMA(l) proof system for A, no 
matter which quantum proof \(j>) of size (?.m(|x|) is given, V never accepts x. Hence, in the algorithm in Figure 4, 
the probability of acceptance is zero and the soundness follows. □ 

Now the following characterization of NQP is immediate. 

Corollary 14. NQP = U c: z+->(o,i] QMA(1, c, 0). 

6 Discussions 

This section shows that there is no POVM measurement that determines whether a given unknown state is in a 
tensor product form or even maximally entangled. 

Suppose that there is a quantum subroutine that answers which of the following (a) and (b) is true for a given 
proof I G TL® 2 of 2n qubits, where H is the Hilbert space consisting of n qubits: 

(a) |*)(*|isinH = {|* )(*oh l^o)^ 82 , 3|0), \tp) e H, |*o> = |$ ® M}, 

(b) |*)<v|/| is in Hf = {|*i)(*i| : |*i) G W® 2 , max| 0> ^ >eW F(|*i)(*i|, \<P)(<P\ ® < 1 - e}. 
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As for the proof |^) that does not satisfy (a) nor (b), this subroutine may answer (a) or (b) arbitrarily. The rest 
of this section proves that this kind of subroutines cannot be realized by any physical method. In fact, we prove 
a stronger statement that the set of states in a tensor product form cannot be distinguished even from the set of 
maximally entangled states by any physical operation. Here, following Ref. [14], we say that the n-qubit state 
p = |*)(*| is maximally entangled if |^) can be written as 

d 1 

I*) = ^Z a Mi)®\fi)^ N 2 = ^ 



=1 



where d = 2 n is the dimension of H and {|ej)} and {(/«)} are orthonormal bases of H. Among all states, maximally 
entangled states are farthest away from states in a tensor product form, and 

lr ™ 2 , F (\y)(vi\<t>)(4>\ ® KWI) = -7= = 2-5 

is achieved by maximally entangled states. Thus Arthur cannot rule out quantum proofs that are far from states of 
a tensor product of pure states. 

Theorem 15. Suppose that one of the following two is true for a given proof \^f) G TL® 2 of In qubits: 

(a) |*)(*| is in H = {|*o)(*o| : |*o) G W® 2 , 3|0), |Y>) G W, |*o) = 10) ® |Y>>}, 

0>j |*)(*| is in Hi = : G W 02 is maximally entangled}. 

77iera, in determining which of (a) and (b) is true, no POVM measurement is better than the trivial strategy in which 
one guesses at random without any operation at all. 

Proof Let M = {M , Mi} be a POVM on H® 2 . With M we conclude |*) (^\ G H, if M results in i, i G {0, 1}. 
Let P^-(|^)(*|) denote the probability that |^)(*| G H^ is concluded by M while | V I / )( V I'| G Hj is true. We 
want to find the measurement that minimizes P Vf >1 (|^)(^['|) keeping the other side of error small enough. More 
precisely, we consider £ defined and bounded as follows. 

£ d ^ minjmaxPSSiGo): maxPfl (p) < d} 

>min{/ pM^poidp): [ P^ (p) m (dp) < s) 

where each pi is an arbitrary probability measure in Hj. It follows that £ is larger than the error probability in 
distinguishing J peHo pp (dp) from f peHi ppi(dp). 

Take ^0 as a uniform distribution over the set {|ej)(ej| \ e j)( e j\}i<i,j<d, that is, po(\ei)(ei\ \ej)(ej\) = 
for each i and j, where {|ej)} is an orthonormal basis of H, and take p\ as a uniform distribution over the set 
{\gk,i)(9k,i\}i<k,i<d, that is, pi(\g k ,i)(gk,i\) = for each k and I, where 

1 d 

\9k,i) = 2 XX eW3T ^l e j) ® l e (i+0 modrf})- 
This {|gfc,z}} forms an orthonormal basis of H® 2 [15], and thus 

/ PPo(dp) = I PPi(dp) = 4/ w ®2. 
Hence we have the assertion. □ 
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From Theorem 15, it is easy to show the following corollary. 
Corollary 16. Suppose one of the following two is true for the proof \^) £ TL® 2 of In qubits: 
(a) |*)(*|wmH = {|*o)(*oh l*o> G W® 2 , 3|0),|^)eH, |* ) = 10) ® |^)}, 
W |*)<*| is in Hf = : |*i> € H® 2 , max|0 )We « F^)^, \<f>){<f>\ ® < 1 - 4 

n 

r/ie«, /or a«y < e < 1 — 2 determining which of (a) and (b) is true, no POVM measurement is better than 

the trivial strategy in which one guesses at random without any operation at all. 

7 Conclusions 

This paper introduced the multi-proof version of quantum Merlin-Arthur proof systems. To investigate the possi- 
bility that multi-proof quantum Merlin- Arthur proof systems collapse to usual single-proof ones, this paper proved 
several basic properties such as a necessary and sufficient condition under which the number of quantum proofs 
is reducible to two. However, the central question whether multiple quantum proofs are indeed more helpful to 
Arthur still remains open. The authors hope that this paper sheds light on new features on quantum Merlin-Arthur 
proof systems and entanglement theory, and more widely on quantum computational complexity and quantum 
information theory. 
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